Artificial Intelligence Policy Tracker
Search
Menu

AI policy explorer

Search and filter source-backed AI laws, regulations, standards, guidance and consultations. Each record shows its status, key dates, verification state and official source.

Results

5 of 244 instruments match

California (United States) Regulation In force Binding

California CPPA automated decision-making rules

California Privacy Protection Agency regulations on automated decision-making technology, risk assessments and cybersecurity audits

Regulations under the California Consumer Privacy Act on automated decision-making technology (ADMT), risk assessments and cybersecurity audits. Businesses that use ADMT to make significant decisions about consumers must comply from 1 January 2027, with further deadlines phased into 2028.

Applies from 1 Jan 2027 Pending review (a factual check against the official source, not a legal review) Official source
Colorado (United States) Act / statute Adopted Binding

Colorado ADMT law (SB 26-189)

Colorado Senate Bill 26-189: Automated Decision-Making Technology (replacement of the Colorado AI Act)

SB 26-189 replaces the Colorado AI Act's regulation of "high-risk" AI systems with duties that attach when automated decision-making technology materially influences a consequential decision about a Colorado consumer in areas such as employment, lending, housing, education, healthcare, insurance and government services. It drops the earlier duty of reasonable care, the mandatory risk-management programme, impact assessments and Attorney General notification, and substitutes advance notice to the consumer, disclosure after an adverse outcome, meaningful human review, three-year record keeping and developer documentation obligations.

Applies from 1 Jan 2027 Pending review (a factual check against the official source, not a legal review) Official source
Colorado (United States) Act / statute Repealed Binding

Colorado AI Act

Colorado Senate Bill 24-205: Consumer Protections for Artificial Intelligence (Colorado AI Act)

The Colorado AI Act requires developers and deployers of high-risk AI systems to use reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination. High-risk systems are those that make, or are a substantial factor in making, consequential decisions about education, employment, financial or lending services, essential government services, healthcare, housing, insurance or legal services. Deployers must run risk-management programmes and impact assessments, notify consumers, and explain adverse decisions; developers must document systems and disclose known risks.

Adopted 17 May 2024 Pending review (a factual check against the official source, not a legal review) Official source
Dubai (United Arab Emirates) Regulation In force Binding

DIFC Regulation 10 (AI and personal data)

DIFC Data Protection Regulations, Regulation 10: personal data processed through autonomous and semi-autonomous systems

Sets rules for personal data processed through autonomous and semi-autonomous systems in the Dubai International Financial Centre: notice and transparency when such a system is used, the deployer as controller and the operator as processor, limits on purposes, a future certification scheme, and an Autonomous Systems Officer for high-risk processing.

Adopted 1 Sep 2023 Pending review (a factual check against the official source, not a legal review) Official source
European Union Regulation Partially applicable Binding

EU AI Act

Regulation (EU) 2024/1689 — Artificial Intelligence Act

The EU AI Act is a binding regulation that sets rules for developing, placing on the market and using AI systems in the European Union. It bans a small set of practices considered unacceptable, imposes detailed requirements on "high-risk" AI systems used in areas such as employment, education, credit, essential services, law enforcement and safety-critical products, requires transparency for chatbots and synthetic content, and creates separate duties for providers of general-purpose AI models. Obligations apply in phases between 2025 and 2028.

Applies from 2 Aug 2026 Pending review (a factual check against the official source, not a legal review) Official source

Frequently asked questions

What counts as an AI policy instrument here?

Anything a government or standards body has actually issued: acts, regulations, executive orders, rules, national strategies, frameworks, guidance, codes of practice, voluntary standards and open consultations. Each record states which of those it is, whether it binds anyone, and links the official source it was read from.

Are these records legally verified?

A record is marked verified only after a named reviewer has opened its official source and confirmed each field. Anything that has not been through that carries "pending review" on the record itself, and the data-health document reports the current totals. Nothing here is legal advice.

How current is the information?

Every record carries the date its source document was published and the date it was last checked. A record not re-checked within the freshness window set by the verification policy is flagged as stale rather than quietly presented as current.

Can I reuse this data?

Yes. The records are published under CC BY 4.0 with attribution, and are available as CSV, newline-delimited JSON and a read-only REST API that needs no key. Cite the record URL, the date accessed and the official source alongside it.